GHSA-7jvp-hj45-2f2mHighDisclosed before NVD

Scriban: Template Writes to Arbitrary CLR Properties via `TypedObjectAccessor` (Mass Assignment + `private` / `init` / `internal` Setter Bypass)

Published
July 6, 2026
Last Modified
July 6, 2026

📋 Description

Declaration | Developer intent | Actual behavior -- | -- | -- { get; set; } | writable | writable (mass assignment — A) { get; private set; } | only the owning class writes | template writes freely { get; internal set; } | only the declaring assembly writes | template writes freely { get; init; } | immutable after construction (C# 9 language guarantee) | template writes freely post-construction

🎯 Affected products1

  • nuget/Scriban:<= 7.2.1

🔗 References (2)